"Fossies" - the Fresh Open Source Software Archive  

Source code changes of the file "lib/luks2/luks2_keyslot.c" between
cryptsetup-2.0.6.tar.xz and cryptsetup-2.1.0.tar.xz

About: cryptsetup is a utility used to conveniently setup disk encryption based on the dm-crypt kernel module. These include plain dm-crypt volumes, LUKS volumes, loop-AES and TrueCrypt compatible format.

luks2_keyslot.c  (cryptsetup-2.0.6.tar.xz):luks2_keyslot.c  (cryptsetup-2.1.0.tar.xz)
/* /*
* LUKS - Linux Unified Key Setup v2, keyslot handling * LUKS - Linux Unified Key Setup v2, keyslot handling
* *
* Copyright (C) 2015-2018, Red Hat, Inc. All rights reserved. * Copyright (C) 2015-2019 Red Hat, Inc. All rights reserved.
* Copyright (C) 2015-2018, Milan Broz. All rights reserved. * Copyright (C) 2015-2019 Milan Broz
* *
* This program is free software; you can redistribute it and/or * This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License * modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2 * as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version. * of the License, or (at your option) any later version.
* *
* This program is distributed in the hope that it will be useful, * This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of * but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details. * GNU General Public License for more details.
skipping to change at line 86 skipping to change at line 86
/* Check if a keyslot is asssigned to specific segment */ /* Check if a keyslot is asssigned to specific segment */
int LUKS2_keyslot_for_segment(struct luks2_hdr *hdr, int keyslot, int segment) int LUKS2_keyslot_for_segment(struct luks2_hdr *hdr, int keyslot, int segment)
{ {
int keyslot_digest, segment_digest; int keyslot_digest, segment_digest;
/* no need to check anything */ /* no need to check anything */
if (segment == CRYPT_ANY_SEGMENT) if (segment == CRYPT_ANY_SEGMENT)
return 0; return 0;
keyslot_digest = LUKS2_digest_by_keyslot(NULL, hdr, keyslot); keyslot_digest = LUKS2_digest_by_keyslot(hdr, keyslot);
if (keyslot_digest < 0) if (keyslot_digest < 0)
return -EINVAL; return -EINVAL;
segment_digest = LUKS2_digest_by_segment(NULL, hdr, segment); segment_digest = LUKS2_digest_by_segment(hdr, segment);
if (segment_digest < 0) if (segment_digest < 0)
return segment_digest; return segment_digest;
return segment_digest == keyslot_digest ? 0 : -ENOENT; return segment_digest == keyslot_digest ? 0 : -ENOENT;
} }
/* Number of keyslots assigned to a segment or all keyslots for CRYPT_ANY_SEGMEN T */ /* Number of keyslots assigned to a segment or all keyslots for CRYPT_ANY_SEGMEN T */
int LUKS2_keyslot_active_count(struct luks2_hdr *hdr, int segment) int LUKS2_keyslot_active_count(struct luks2_hdr *hdr, int segment)
{ {
int num = 0; int num = 0;
skipping to change at line 114 skipping to change at line 114
json_object_object_foreach(jobj_keyslots, slot, val) { json_object_object_foreach(jobj_keyslots, slot, val) {
UNUSED(val); UNUSED(val);
if (!LUKS2_keyslot_for_segment(hdr, atoi(slot), segment)) if (!LUKS2_keyslot_for_segment(hdr, atoi(slot), segment))
num++; num++;
} }
return num; return num;
} }
int LUKS2_keyslot_cipher_incompatible(struct crypt_device *cd) int LUKS2_keyslot_cipher_incompatible(struct crypt_device *cd, const char *ciphe r_spec)
{ {
const char *cipher = crypt_get_cipher(cd); char cipher[MAX_CIPHER_LEN], cipher_mode[MAX_CIPHER_LEN];
const char *cipher_mode = crypt_get_cipher_mode(cd);
if (!cipher_spec || !strcmp(cipher_spec, "null") || !strcmp(cipher_spec,
"cipher_null"))
return 1;
if (crypt_parse_name_and_mode(cipher_spec, cipher, NULL, cipher_mode) < 0
)
return 1;
/* Keyslot is already authenticated; we cannot use integrity tags here */ /* Keyslot is already authenticated; we cannot use integrity tags here */
if (crypt_get_integrity_tag_size(cd) || !cipher) if (crypt_get_integrity_tag_size(cd))
return 1; return 1;
/* Wrapped key schemes cannot be used for keyslot encryption */ /* Wrapped key schemes cannot be used for keyslot encryption */
if (crypt_cipher_wrapped_key(cipher, cipher_mode)) if (crypt_cipher_wrapped_key(cipher, cipher_mode))
return 1; return 1;
/* Check if crypto backend can use the cipher */ /* Check if crypto backend can use the cipher */
if (crypt_cipher_ivsize(cipher, cipher_mode) < 0) if (crypt_cipher_ivsize(cipher, cipher_mode) < 0)
return 1; return 1;
return 0; return 0;
} }
int LUKS2_keyslot_params_default(struct crypt_device *cd, struct luks2_hdr *hdr, int LUKS2_keyslot_params_default(struct crypt_device *cd, struct luks2_hdr *hdr,
size_t key_size, struct luks2_keyslot_params *params) struct luks2_keyslot_params *params)
{ {
int r, integrity_key_size = crypt_get_integrity_key_size(cd);
const struct crypt_pbkdf_type *pbkdf = crypt_get_pbkdf_type(cd); const struct crypt_pbkdf_type *pbkdf = crypt_get_pbkdf_type(cd);
const char *cipher_spec;
size_t key_size;
int r;
if (!hdr || !pbkdf || !params) if (!hdr || !pbkdf || !params)
return -EINVAL; return -EINVAL;
params->af_type = LUKS2_KEYSLOT_AF_LUKS1; /*
* set keyslot area encryption parameters
*/
params->area_type = LUKS2_KEYSLOT_AREA_RAW; params->area_type = LUKS2_KEYSLOT_AREA_RAW;
cipher_spec = crypt_keyslot_get_encryption(cd, CRYPT_ANY_SLOT, &key_size)
;
if (!cipher_spec || !key_size)
return -EINVAL;
/* set keyslot AF parameters */ params->area.raw.key_size = key_size;
r = snprintf(params->area.raw.encryption, sizeof(params->area.raw.encrypt
ion), "%s", cipher_spec);
if (r < 0 || (size_t)r >= sizeof(params->area.raw.encryption))
return -EINVAL;
/*
* set keyslot AF parameters
*/
params->af_type = LUKS2_KEYSLOT_AF_LUKS1;
/* currently we use hash for AF from pbkdf settings */ /* currently we use hash for AF from pbkdf settings */
r = snprintf(params->af.luks1.hash, sizeof(params->af.luks1.hash), r = snprintf(params->af.luks1.hash, sizeof(params->af.luks1.hash), "%s",
"%s", pbkdf->hash); pbkdf->hash);
if (r < 0 || (size_t)r >= sizeof(params->af.luks1.hash)) if (r < 0 || (size_t)r >= sizeof(params->af.luks1.hash))
return -EINVAL; return -EINVAL;
params->af.luks1.stripes = 4000; params->af.luks1.stripes = 4000;
/* set keyslot area encryption parameters */ return 0;
/* short circuit authenticated encryption hardcoded defaults */ }
if (LUKS2_keyslot_cipher_incompatible(cd) || key_size == 0) {
// FIXME: fixed cipher and key size can be wrong
snprintf(params->area.raw.encryption, sizeof(params->area.raw.enc
ryption),
"aes-xts-plain64");
params->area.raw.key_size = 32;
return 0;
}
r = snprintf(params->area.raw.encryption, sizeof(params->area.raw.encrypt int LUKS2_keyslot_pbkdf(struct luks2_hdr *hdr, int keyslot, struct crypt_pbkdf_t
ion), ype *pbkdf)
"%s", LUKS2_get_cipher(hdr, CRYPT_DEFAULT_SEGMENT)); {
if (r < 0 || (size_t)r >= sizeof(params->area.raw.encryption)) json_object *jobj_keyslot, *jobj_kdf, *jobj;
if (!hdr || !pbkdf)
return -EINVAL; return -EINVAL;
/* Slot encryption tries to use the same key size as for the main algorit if (LUKS2_keyslot_info(hdr, keyslot) == CRYPT_SLOT_INVALID)
hm */
if ((size_t)integrity_key_size > key_size)
return -EINVAL; return -EINVAL;
params->area.raw.key_size = key_size - integrity_key_size;
jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot);
if (!jobj_keyslot)
return -ENOENT;
if (!json_object_object_get_ex(jobj_keyslot, "kdf", &jobj_kdf))
return -EINVAL;
if (!json_object_object_get_ex(jobj_kdf, "type", &jobj))
return -EINVAL;
memset(pbkdf, 0, sizeof(*pbkdf));
pbkdf->type = json_object_get_string(jobj);
if (json_object_object_get_ex(jobj_kdf, "hash", &jobj))
pbkdf->hash = json_object_get_string(jobj);
if (json_object_object_get_ex(jobj_kdf, "iterations", &jobj))
pbkdf->iterations = json_object_get_int(jobj);
if (json_object_object_get_ex(jobj_kdf, "time", &jobj))
pbkdf->iterations = json_object_get_int(jobj);
if (json_object_object_get_ex(jobj_kdf, "memory", &jobj))
pbkdf->max_memory_kb = json_object_get_int(jobj);
if (json_object_object_get_ex(jobj_kdf, "cpus", &jobj))
pbkdf->parallel_threads = json_object_get_int(jobj);
return 0; return 0;
} }
static int LUKS2_keyslot_unbound(struct luks2_hdr *hdr, int keyslot) static int LUKS2_keyslot_unbound(struct luks2_hdr *hdr, int keyslot)
{ {
json_object *jobj_digest, *jobj_segments; json_object *jobj_digest, *jobj_segments;
int digest = LUKS2_digest_by_keyslot(NULL, hdr, keyslot); int digest = LUKS2_digest_by_keyslot(hdr, keyslot);
if (digest < 0) if (digest < 0)
return 0; return 0;
if (!(jobj_digest = LUKS2_get_digest_jobj(hdr, digest))) if (!(jobj_digest = LUKS2_get_digest_jobj(hdr, digest)))
return 0; return 0;
json_object_object_get_ex(jobj_digest, "segments", &jobj_segments); json_object_object_get_ex(jobj_digest, "segments", &jobj_segments);
if (!jobj_segments || !json_object_is_type(jobj_segments, json_type_array ) || if (!jobj_segments || !json_object_is_type(jobj_segments, json_type_array ) ||
json_object_array_length(jobj_segments) == 0) json_object_array_length(jobj_segments) == 0)
skipping to change at line 259 skipping to change at line 294
struct volume_key **vk) struct volume_key **vk)
{ {
const keyslot_handler *h; const keyslot_handler *h;
int key_size, r; int key_size, r;
if (!(h = LUKS2_keyslot_handler(cd, keyslot))) if (!(h = LUKS2_keyslot_handler(cd, keyslot)))
return -ENOENT; return -ENOENT;
r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot)); r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot));
if (r) { if (r) {
log_dbg("Keyslot %d validation failed.", keyslot); log_dbg(cd, "Keyslot %d validation failed.", keyslot);
return r; return r;
} }
r = LUKS2_keyslot_for_segment(hdr, keyslot, segment); r = LUKS2_keyslot_for_segment(hdr, keyslot, segment);
if (r) { if (r) {
if (r == -ENOENT) if (r == -ENOENT)
log_dbg("Keyslot %d unusable for segment %d.", keyslot, s egment); log_dbg(cd, "Keyslot %d unusable for segment %d.", keyslo t, segment);
return r; return r;
} }
key_size = LUKS2_get_volume_key_size(hdr, segment); key_size = LUKS2_get_volume_key_size(hdr, segment);
if (key_size < 0) if (key_size < 0)
key_size = LUKS2_get_keyslot_key_size(hdr, keyslot); key_size = LUKS2_get_keyslot_stored_key_size(hdr, keyslot);
if (key_size < 0) if (key_size < 0)
return -EINVAL; return -EINVAL;
*vk = crypt_alloc_volume_key(key_size, NULL); *vk = crypt_alloc_volume_key(key_size, NULL);
if (!*vk) if (!*vk)
return -ENOMEM; return -ENOMEM;
r = h->open(cd, keyslot, password, password_len, (*vk)->key, (*vk)->keyle ngth); r = h->open(cd, keyslot, password, password_len, (*vk)->key, (*vk)->keyle ngth);
if (r < 0) if (r < 0)
log_dbg("Keyslot %d (%s) open failed with %d.", keyslot, h->name, r); log_dbg(cd, "Keyslot %d (%s) open failed with %d.", keyslot, h->n ame, r);
else else
r = LUKS2_digest_verify(cd, hdr, *vk, keyslot); r = LUKS2_digest_verify(cd, hdr, *vk, keyslot);
if (r < 0) { if (r < 0) {
crypt_free_volume_key(*vk); crypt_free_volume_key(*vk);
*vk = NULL; *vk = NULL;
} }
return r < 0 ? r : keyslot; return r < 0 ? r : keyslot;
} }
skipping to change at line 316 skipping to change at line 351
json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots); json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots);
json_object_object_foreach(jobj_keyslots, slot, val) { json_object_object_foreach(jobj_keyslots, slot, val) {
if (!json_object_object_get_ex(val, "priority", &jobj)) if (!json_object_object_get_ex(val, "priority", &jobj))
slot_priority = CRYPT_SLOT_PRIORITY_NORMAL; slot_priority = CRYPT_SLOT_PRIORITY_NORMAL;
else else
slot_priority = json_object_get_int(jobj); slot_priority = json_object_get_int(jobj);
keyslot = atoi(slot); keyslot = atoi(slot);
if (slot_priority != priority) { if (slot_priority != priority) {
log_dbg("Keyslot %d priority %d != %d (required), skipped .", log_dbg(cd, "Keyslot %d priority %d != %d (required), ski pped.",
keyslot, slot_priority, priority); keyslot, slot_priority, priority);
continue; continue;
} }
r = LUKS2_open_and_verify(cd, hdr, keyslot, segment, password, pa ssword_len, vk); r = LUKS2_open_and_verify(cd, hdr, keyslot, segment, password, pa ssword_len, vk);
/* Do not retry for errors that are no -EPERM or -ENOENT, /* Do not retry for errors that are no -EPERM or -ENOENT,
former meaning password wrong, latter key slot unusable for se gment */ former meaning password wrong, latter key slot unusable for se gment */
if ((r != -EPERM) && (r != -ENOENT)) if ((r != -EPERM) && (r != -ENOENT))
break; break;
skipping to change at line 392 skipping to change at line 427
r = h->alloc(cd, keyslot, vk->keylength, params); r = h->alloc(cd, keyslot, vk->keylength, params);
if (r) if (r)
return r; return r;
} else { } else {
if (!(h = LUKS2_keyslot_handler(cd, keyslot))) if (!(h = LUKS2_keyslot_handler(cd, keyslot)))
return -EINVAL; return -EINVAL;
r = h->update(cd, keyslot, params); r = h->update(cd, keyslot, params);
if (r) { if (r) {
log_dbg("Failed to update keyslot %d json.", keyslot); log_dbg(cd, "Failed to update keyslot %d json.", keyslot) ;
return r; return r;
} }
} }
r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot)); r = h->validate(cd, LUKS2_get_keyslot_jobj(hdr, keyslot));
if (r) { if (r) {
log_dbg("Keyslot validation failed."); log_dbg(cd, "Keyslot validation failed.");
return r; return r;
} }
return h->store(cd, keyslot, password, password_len, return h->store(cd, keyslot, password, password_len,
vk->key, vk->keylength); vk->key, vk->keylength);
} }
int LUKS2_keyslot_wipe(struct crypt_device *cd, int LUKS2_keyslot_wipe(struct crypt_device *cd,
struct luks2_hdr *hdr, struct luks2_hdr *hdr,
int keyslot, int keyslot,
int wipe_area_only) int wipe_area_only)
{ {
struct device *device = crypt_metadata_device(cd); struct device *device = crypt_metadata_device(cd);
uint64_t area_offset, area_length; uint64_t area_offset, area_length;
char num[16];
int r; int r;
json_object *jobj_keyslot, *jobj_keyslots; json_object *jobj_keyslot, *jobj_keyslots;
const keyslot_handler *h; const keyslot_handler *h;
h = LUKS2_keyslot_handler(cd, keyslot); h = LUKS2_keyslot_handler(cd, keyslot);
if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots)) if (!json_object_object_get_ex(hdr->jobj, "keyslots", &jobj_keyslots))
return -EINVAL; return -EINVAL;
jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot); jobj_keyslot = LUKS2_get_keyslot_jobj(hdr, keyslot);
if (!jobj_keyslot) if (!jobj_keyslot)
return -ENOENT; return -ENOENT;
if (wipe_area_only) if (wipe_area_only)
log_dbg("Wiping keyslot %d area only.", keyslot); log_dbg(cd, "Wiping keyslot %d area only.", keyslot);
/* Just check that nobody uses the metadata now */ /* Just check that nobody uses the metadata now */
r = device_write_lock(cd, device); r = device_write_lock(cd, device);
if (r) { if (r) {
log_err(cd, _("Failed to acquire write lock on device %s."), log_err(cd, _("Failed to acquire write lock on device %s."),
device_path(device)); device_path(device));
return r; return r;
} }
device_write_unlock(device); device_write_unlock(cd, device);
/* secure deletion of possible key material in keyslot area */ /* secure deletion of possible key material in keyslot area */
r = crypt_keyslot_area(cd, keyslot, &area_offset, &area_length); r = crypt_keyslot_area(cd, keyslot, &area_offset, &area_length);
if (r && r != -ENOENT) if (r && r != -ENOENT)
return r; return r;
/* We can destroy the binary keyslot area now without lock */ /* We can destroy the binary keyslot area now without lock */
if (!r) { if (!r) {
r = crypt_wipe_device(cd, device, CRYPT_WIPE_SPECIAL, area_offset , r = crypt_wipe_device(cd, device, CRYPT_WIPE_SPECIAL, area_offset ,
area_length, area_length, NULL, NULL); area_length, area_length, NULL, NULL);
skipping to change at line 469 skipping to change at line 503
if (wipe_area_only) if (wipe_area_only)
return r; return r;
/* Slot specific wipe */ /* Slot specific wipe */
if (h) { if (h) {
r = h->wipe(cd, keyslot); r = h->wipe(cd, keyslot);
if (r < 0) if (r < 0)
return r; return r;
} else } else
log_dbg("Wiping keyslot %d without specific-slot handler loaded." , keyslot); log_dbg(cd, "Wiping keyslot %d without specific-slot handler load ed.", keyslot);
snprintf(num, sizeof(num), "%d", keyslot); json_object_object_del_by_uint(jobj_keyslots, keyslot);
json_object_object_del(jobj_keyslots, num);
return LUKS2_hdr_write(cd, hdr); return LUKS2_hdr_write(cd, hdr);
} }
int LUKS2_keyslot_dump(struct crypt_device *cd, int keyslot) int LUKS2_keyslot_dump(struct crypt_device *cd, int keyslot)
{ {
const keyslot_handler *h; const keyslot_handler *h;
if (!(h = LUKS2_keyslot_handler(cd, keyslot))) if (!(h = LUKS2_keyslot_handler(cd, keyslot)))
return -EINVAL; return -EINVAL;
skipping to change at line 526 skipping to change at line 559
return commit ? LUKS2_hdr_write(cd, hdr) : 0; return commit ? LUKS2_hdr_write(cd, hdr) : 0;
} }
int placeholder_keyslot_alloc(struct crypt_device *cd, int placeholder_keyslot_alloc(struct crypt_device *cd,
int keyslot, int keyslot,
uint64_t area_offset, uint64_t area_offset,
uint64_t area_length, uint64_t area_length,
size_t volume_key_len) size_t volume_key_len)
{ {
struct luks2_hdr *hdr; struct luks2_hdr *hdr;
char num[16];
json_object *jobj_keyslots, *jobj_keyslot, *jobj_area; json_object *jobj_keyslots, *jobj_keyslot, *jobj_area;
log_dbg("Allocating placeholder keyslot %d for LUKS1 down conversion.", k eyslot); log_dbg(cd, "Allocating placeholder keyslot %d for LUKS1 down conversion. ", keyslot);
if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2))) if (!(hdr = crypt_get_hdr(cd, CRYPT_LUKS2)))
return -EINVAL; return -EINVAL;
if (keyslot < 0 || keyslot >= LUKS2_KEYSLOTS_MAX) if (keyslot < 0 || keyslot >= LUKS2_KEYSLOTS_MAX)
return -EINVAL; return -EINVAL;
if (LUKS2_get_keyslot_jobj(hdr, keyslot)) if (LUKS2_get_keyslot_jobj(hdr, keyslot))
return -EINVAL; return -EINVAL;
skipping to change at line 558 skipping to change at line 590
* LUKS2 header. * LUKS2 header.
*/ */
json_object_object_add(jobj_keyslot, "key_size", json_object_new_int(-1)) ; json_object_object_add(jobj_keyslot, "key_size", json_object_new_int(-1)) ;
/* Area object */ /* Area object */
jobj_area = json_object_new_object(); jobj_area = json_object_new_object();
json_object_object_add(jobj_area, "offset", json_object_new_uint64(area_o ffset)); json_object_object_add(jobj_area, "offset", json_object_new_uint64(area_o ffset));
json_object_object_add(jobj_area, "size", json_object_new_uint64(area_len gth)); json_object_object_add(jobj_area, "size", json_object_new_uint64(area_len gth));
json_object_object_add(jobj_keyslot, "area", jobj_area); json_object_object_add(jobj_keyslot, "area", jobj_area);
snprintf(num, sizeof(num), "%d", keyslot); json_object_object_add_by_uint(jobj_keyslots, keyslot, jobj_keyslot);
json_object_object_add(jobj_keyslots, num, jobj_keyslot);
return 0; return 0;
} }
static unsigned LUKS2_get_keyslot_digests_count(json_object *hdr_jobj, int keysl ot) static unsigned LUKS2_get_keyslot_digests_count(json_object *hdr_jobj, int keysl ot)
{ {
char num[16]; char num[16];
json_object *jobj_digests, *jobj_keyslots; json_object *jobj_digests, *jobj_keyslots;
unsigned count = 0; unsigned count = 0;
skipping to change at line 588 skipping to change at line 618
UNUSED(key); UNUSED(key);
json_object_object_get_ex(val, "keyslots", &jobj_keyslots); json_object_object_get_ex(val, "keyslots", &jobj_keyslots);
if (LUKS2_array_jobj(jobj_keyslots, num)) if (LUKS2_array_jobj(jobj_keyslots, num))
count++; count++;
} }
return count; return count;
} }
/* run only on header that passed basic format validation */ /* run only on header that passed basic format validation */
int LUKS2_keyslots_validate(json_object *hdr_jobj) int LUKS2_keyslots_validate(struct crypt_device *cd, json_object *hdr_jobj)
{ {
const keyslot_handler *h; const keyslot_handler *h;
int keyslot; int keyslot;
json_object *jobj_keyslots, *jobj_type; json_object *jobj_keyslots, *jobj_type;
if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots)) if (!json_object_object_get_ex(hdr_jobj, "keyslots", &jobj_keyslots))
return -EINVAL; return -EINVAL;
json_object_object_foreach(jobj_keyslots, slot, val) { json_object_object_foreach(jobj_keyslots, slot, val) {
keyslot = atoi(slot); keyslot = atoi(slot);
json_object_object_get_ex(val, "type", &jobj_type); json_object_object_get_ex(val, "type", &jobj_type);
h = LUKS2_keyslot_handler_type(NULL, json_object_get_string(jobj_ type)); h = LUKS2_keyslot_handler_type(cd, json_object_get_string(jobj_ty pe));
if (!h) if (!h)
continue; continue;
if (h->validate && h->validate(NULL, val)) { if (h->validate && h->validate(cd, val)) {
log_dbg("Keyslot type %s validation failed on keyslot %d. log_dbg(cd, "Keyslot type %s validation failed on keyslot
", h->name, keyslot); %d.", h->name, keyslot);
return -EINVAL; return -EINVAL;
} }
if (!strcmp(h->name, "luks2") && LUKS2_get_keyslot_digests_count( hdr_jobj, keyslot) != 1) { if (!strcmp(h->name, "luks2") && LUKS2_get_keyslot_digests_count( hdr_jobj, keyslot) != 1) {
log_dbg("Keyslot %d is not assigned to exactly 1 digest." , keyslot); log_dbg(cd, "Keyslot %d is not assigned to exactly 1 dige st.", keyslot);
return -EINVAL; return -EINVAL;
} }
} }
return 0; return 0;
} }
void LUKS2_keyslots_repair(json_object *jobj_keyslots) void LUKS2_keyslots_repair(struct crypt_device *cd, json_object *jobj_keyslots)
{ {
const keyslot_handler *h; const keyslot_handler *h;
json_object *jobj_type; json_object *jobj_type;
json_object_object_foreach(jobj_keyslots, slot, val) { json_object_object_foreach(jobj_keyslots, slot, val) {
UNUSED(slot); UNUSED(slot);
if (!json_object_is_type(val, json_type_object) || if (!json_object_is_type(val, json_type_object) ||
!json_object_object_get_ex(val, "type", &jobj_type) || !json_object_object_get_ex(val, "type", &jobj_type) ||
!json_object_is_type(jobj_type, json_type_string)) !json_object_is_type(jobj_type, json_type_string))
continue; continue;
h = LUKS2_keyslot_handler_type(NULL, json_object_get_string(jobj_ type)); h = LUKS2_keyslot_handler_type(cd, json_object_get_string(jobj_ty pe));
if (h && h->repair) if (h && h->repair)
h->repair(NULL, val); h->repair(cd, val);
} }
} }
 End of changes. 41 change blocks. 
61 lines changed or deleted 94 lines changed or added

Home  |  About  |  Features  |  All  |  Newest  |  Dox  |  Diffs  |  RSS Feeds  |  Screenshots  |  Comments  |  Imprint  |  Privacy  |  HTTP(S)